@hominis/fireforge 0.50.0 → 0.52.0

package/dist/src/core/patch-export-update.js

@@ -25,7 +25,7 @@ import { buildProjectedManifest, enforcePatchPolicy } from './patch-policy.js';
  *   already byte-identical to the new content.
  */
 export async function updatePatchAndMetadata(options) {
-    const { patchesDir, filename, newContent, updates, onCommitted, policyGate, lockOptions = {}, } = options;
+    const { patchesDir, filename, newContent, updates, unset = [], onCommitted, policyGate, lockOptions = {}, } = options;
     return withPatchDirectoryLock(patchesDir, async () => {
         const manifest = await loadPatchesManifestForWrite(patchesDir);
         if (!manifest) {
@@ -41,7 +41,7 @@ export async function updatePatchAndMetadata(options) {
         }
         const originalContent = await readText(patchPath);
         const existingPatch = manifest.patches[patchIndex];
-        manifest.patches[patchIndex] = { ...existingPatch, ...updates };
+        manifest.patches[patchIndex] = withoutFields({ ...existingPatch, ...updates }, unset);
         if (policyGate !== undefined) {
             enforcePatchPolicy({
                 config: policyGate.config,
@@ -59,7 +59,7 @@ export async function updatePatchAndMetadata(options) {
                 await writeText(patchPath, normalized);
                 patchWritten = true;
             }
-            await mutatePatchRowsInManifest(patchesDir, [filename], () => ({ set: updates }));
+            await mutatePatchRowsInManifest(patchesDir, [filename], () => ({ set: updates, unset }));
         }
         catch (error) {
             if (patchWritten) {
@@ -84,3 +84,12 @@ export async function updatePatchAndMetadata(options) {
         return bodyChanged;
     }, lockOptions);
 }
+/** A copy of `row` without `fields`. */
+export function withoutFields(row, fields) {
+    if (fields.length === 0)
+        return row;
+    const copy = { ...row };
+    for (const field of fields)
+        Reflect.deleteProperty(copy, field);
+    return copy;
+}

package/dist/src/core/patch-export.d.ts

@@ -18,9 +18,10 @@ export declare function buildPlanExportInput(input: PlanExportInput): PlanExport
 /**
  * Gets the next patch number for a new patch.
  * @param patchesDir - Path to the patches directory
+ * @param reserved - Orders held by `patch reserve`, skipped
  * @returns Next patch number (e.g., "005" for 4 existing patches)
  */
-export declare function getNextPatchNumber(patchesDir: string): Promise<string>;
+export declare function getNextPatchNumber(patchesDir: string, reserved?: ReadonlySet<number>): Promise<string>;
 /**
  * Sanitizes a human-readable name into a filename slug.
  *
@@ -59,7 +60,7 @@ export declare function patchNameSlug(name: string, category: string): string;
  * @param name - Human-readable name
  * @returns Filename like "001-ui-sidebar.patch"
  */
-export declare function getNextPatchFilename(patchesDir: string, category: PatchCategory, name: string): Promise<string>;
+export declare function getNextPatchFilename(patchesDir: string, category: PatchCategory, name: string, reserved?: ReadonlySet<number>): Promise<string>;
 export interface CommitExportedPatchInput {
     patchesDir: string;
     category: PatchCategory;

package/dist/src/core/patch-export.js

@@ -2,13 +2,13 @@
 import { join } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText, removeFile, writeText } from '../utils/fs.js';
-import { warn } from '../utils/logger.js';
+import { info, warn } from '../utils/logger.js';
 import { discoverPatches, withPatchDirectoryLock } from './patch-apply.js';
 import { findAllPatchesForFilesWithDetails, } from './patch-export-coverage.js';
 import { addPatchToManifest, loadPatchesManifestForWrite, PATCHES_MANIFEST, savePatchesManifest, } from './patch-manifest.js';
 import { formatPatchOrder, requirePatchOrder } from './patch-parse.js';
 import { allocatePolicyOrder, enforcePatchPolicy } from './patch-policy.js';
-import { manifestWithRetiredSlots } from './patch-retired.js';
+import { manifestWithRetiredSlots, reservationAt, reservedOrderSet } from './patch-retired.js';
 export { findAllPatchesForFiles, findAllPatchesForFilesWithDetails, } from './patch-export-coverage.js';
 import { escapeRegex } from '../utils/regex.js';
 export { mutatePatchMetadata, updatePatchMetadata } from './patch-export-metadata.js';
@@ -40,18 +40,16 @@ export function buildPlanExportInput(input) {
 /**
  * Gets the next patch number for a new patch.
  * @param patchesDir - Path to the patches directory
+ * @param reserved - Orders held by `patch reserve`, skipped
  * @returns Next patch number (e.g., "005" for 4 existing patches)
  */
-export async function getNextPatchNumber(patchesDir) {
+export async function getNextPatchNumber(patchesDir, reserved = new Set()) {
     const patches = await discoverPatches(patchesDir);
-    if (patches.length === 0) {
-        return '001';
-    }
     const finitePatches = patches.filter((p) => Number.isFinite(p.order));
-    if (finitePatches.length === 0)
-        return '001';
     const maxOrder = finitePatches.reduce((max, p) => Math.max(max, p.order), 0);
-    const nextNumber = maxOrder + 1;
+    let nextNumber = maxOrder + 1;
+    while (reserved.has(nextNumber))
+        nextNumber++;
     return String(nextNumber).padStart(Math.max(3, String(nextNumber).length), '0');
 }
 /**
@@ -118,8 +116,8 @@ export function patchNameSlug(name, category) {
  * @param name - Human-readable name
  * @returns Filename like "001-ui-sidebar.patch"
  */
-export async function getNextPatchFilename(patchesDir, category, name) {
-    const patchNumber = await getNextPatchNumber(patchesDir);
+export async function getNextPatchFilename(patchesDir, category, name, reserved = new Set()) {
+    const patchNumber = await getNextPatchNumber(patchesDir, reserved);
     const sanitizedName = patchNameSlug(name, category);
     return `${patchNumber}-${category}-${sanitizedName}.patch`;
 }
@@ -234,12 +232,15 @@ async function computeExportPlanUnderLock(input) {
     // wipes the queue metadata, and the rollback path would then delete
     // patches.json entirely because manifestBefore looked absent.
     const manifestBefore = await loadPatchesManifestForWrite(input.patchesDir);
+    // A default allocation never lands on a reservation; only an explicit
+    // `--order` placement fills one.
+    const reserved = reservedOrderSet(manifestBefore ?? {});
     const policyOrder = input.config !== undefined
-        ? allocatePolicyOrder(input.config, manifestBefore?.patches ?? [], input.category)
+        ? allocatePolicyOrder(input.config, manifestBefore?.patches ?? [], input.category, reserved)
         : null;
     const patchFilename = policyOrder !== null
         ? `${formatPatchOrder(policyOrder)}-${input.category}-${patchNameSlug(input.name, input.category)}.patch`
-        : await getNextPatchFilename(input.patchesDir, input.category, input.name);
+        : await getNextPatchFilename(input.patchesDir, input.category, input.name, reserved);
     const patchPath = join(input.patchesDir, patchFilename);
     const metadata = {
         filename: patchFilename,
@@ -267,6 +268,12 @@ async function computeExportPlanUnderLock(input) {
     const afterPatches = (manifestBefore?.patches ?? []).filter((p) => !supersededSet.has(p.filename) && p.filename !== patchFilename);
     afterPatches.push(metadata);
     afterPatches.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));
+    const reservation = reservationAt(manifestBefore, metadata.order);
+    if (reservation !== undefined) {
+        info(`Order ${formatPatchOrder(metadata.order)} was reserved by ${reservation.owner}` +
+            `${reservation.reason !== undefined ? ` (${reservation.reason})` : ''}; ` +
+            'this export fills the reservation.');
+    }
     return {
         patchFilename,
         patchPath,
@@ -274,7 +281,7 @@ async function computeExportPlanUnderLock(input) {
         supersededDetails,
         supersededPatches,
         manifestBefore: manifestBefore ?? null,
-        // A patch landing on a retired order fills that slot.
+        // A patch landing on a retired or reserved order fills that slot.
         manifestAfter: manifestWithRetiredSlots(manifestBefore, afterPatches),
     };
 }

package/dist/src/core/patch-files.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2
-import { readdir } from 'node:fs/promises';
+import { readdir, stat } from 'node:fs/promises';
 import { extname, join } from 'node:path';
 import { pathExists, readText } from '../utils/fs.js';
 import { extractAffectedFiles, extractOrder } from './patch-parse.js';
@@ -9,16 +9,34 @@ export async function discoverPatches(patchesDir) {
         return [];
     }
     const entries = await readdir(patchesDir, { withFileTypes: true });
-    const patches = entries
-        .filter((entry) => entry.isFile() && extname(entry.name) === '.patch')
-        .map((entry) => ({
-        path: join(patchesDir, entry.name),
-        filename: entry.name,
-        order: extractOrder(entry.name),
-    }));
+    const patches = [];
+    for (const entry of entries) {
+        if (extname(entry.name) !== '.patch')
+            continue;
+        // A symlinked patch (a scratch queue built from links to the real
+        // patches) counts when it resolves to a regular file; a dangling link or
+        // a link to a directory does not.
+        if (!entry.isFile() &&
+            !(entry.isSymbolicLink() && (await isLinkToFile(patchesDir, entry.name)))) {
+            continue;
+        }
+        patches.push({
+            path: join(patchesDir, entry.name),
+            filename: entry.name,
+            order: extractOrder(entry.name),
+        });
+    }
     patches.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));
     return patches;
 }
+async function isLinkToFile(dir, name) {
+    try {
+        return (await stat(join(dir, name))).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 /** Counts the patch files currently present in a patch directory. */
 export async function countPatches(patchesDir) {
     const patches = await discoverPatches(patchesDir);

package/dist/src/core/patch-lint-checkjs-any-import.d.ts

@@ -2,10 +2,12 @@
  * Explains an implicit-`any` checkJs finding that comes from a URL import
  * the per-patch program cannot resolve.
  *
- * The program only holds patch-owned files (and, for a test, its own
- * directory's head.js), so a `resource:///` or `chrome://` import of a
- * module another patch creates falls back to the shim's
- * `declare module 'resource:*'` wildcard and types as `any`. A callback
+ * The program resolves URL imports only to modules the queue creates (for
+ * a test, those created up to its own patch, plus its directory's
+ * head.js), so a `resource:///` or `chrome://` import of a module a later
+ * patch creates, an upstream module, or a basename two patches create
+ * falls back to the shim's `declare module 'resource:*'` wildcard and
+ * types as `any`. A callback
  * over its values then has implicitly-`any` parameters under
  * `checkJsStrict`, while the whole-tree `fireforge typecheck`, which sees
  * the module, is clean. Without the note the two disagree with no

package/dist/src/core/patch-lint-checkjs-any-import.js

@@ -3,10 +3,12 @@
  * Explains an implicit-`any` checkJs finding that comes from a URL import
  * the per-patch program cannot resolve.
  *
- * The program only holds patch-owned files (and, for a test, its own
- * directory's head.js), so a `resource:///` or `chrome://` import of a
- * module another patch creates falls back to the shim's
- * `declare module 'resource:*'` wildcard and types as `any`. A callback
+ * The program resolves URL imports only to modules the queue creates (for
+ * a test, those created up to its own patch, plus its directory's
+ * head.js), so a `resource:///` or `chrome://` import of a module a later
+ * patch creates, an upstream module, or a basename two patches create
+ * falls back to the shim's `declare module 'resource:*'` wildcard and
+ * types as `any`. A callback
  * over its values then has implicitly-`any` parameters under
  * `checkJsStrict`, while the whole-tree `fireforge typecheck`, which sees
  * the module, is clean. Without the note the two disagree with no
@@ -35,9 +37,9 @@ export function anyTypedImportHint(code, specifiers) {
         return '';
     const list = [...specifiers].sort().join(', ');
     return (` (This file imports ${list}, which this per-patch checkJs program cannot resolve — ` +
-        'the module is created by another patch outside this program, a later one or one this ' +
-        'test does not share a directory with — so the import is typed `any`. Annotate the ' +
-        'parameter explicitly; the whole-tree "fireforge typecheck" resolves the real type.)');
+        'no patch up to this one creates the module under that name: a later patch creates it, ' +
+        'it is upstream, or two patches create the same basename — so the import is typed `any`. ' +
+        'Annotate the parameter explicitly; the whole-tree "fireforge typecheck" resolves the real type.)');
 }
 /**
  * The host's `resolveModuleNameLiterals`: owned specifiers first, then a

package/dist/src/core/patch-lint-checkjs-diagnostics.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Collects a checkJs program's diagnostics, for every file or for a report
+ * scope only. A per-test program resolves the modules its imports reach
+ * (see `runCheckJsTestFilesGrouped`), and asking for the whole program's
+ * diagnostics would type-check each of those modules once per test, so a
+ * scoped run asks only for the files it reports. Split out of
+ * patch-lint-checkjs.ts for the line budget.
+ */
+/**
+ * The program's semantic and syntactic diagnostics, limited to the files
+ * `reportOnly` names when it is set.
+ *
+ * @param program - The built program
+ * @param relByAbsolute - Owned files: TS path → repo-relative path
+ * @param reportOnly - Repo-relative files to collect for, or all when unset
+ */
+export declare function collectCheckJsDiagnostics(program: import('typescript').Program, relByAbsolute: ReadonlyMap<string, string>, reportOnly: ReadonlySet<string> | undefined): import('typescript').Diagnostic[];

package/dist/src/core/patch-lint-checkjs-diagnostics.js

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Collects a checkJs program's diagnostics, for every file or for a report
+ * scope only. A per-test program resolves the modules its imports reach
+ * (see `runCheckJsTestFilesGrouped`), and asking for the whole program's
+ * diagnostics would type-check each of those modules once per test, so a
+ * scoped run asks only for the files it reports. Split out of
+ * patch-lint-checkjs.ts for the line budget.
+ */
+/**
+ * The program's semantic and syntactic diagnostics, limited to the files
+ * `reportOnly` names when it is set.
+ *
+ * @param program - The built program
+ * @param relByAbsolute - Owned files: TS path → repo-relative path
+ * @param reportOnly - Repo-relative files to collect for, or all when unset
+ */
+export function collectCheckJsDiagnostics(program, relByAbsolute, reportOnly) {
+    if (reportOnly === undefined) {
+        return [...program.getSemanticDiagnostics(), ...program.getSyntacticDiagnostics()];
+    }
+    return program
+        .getSourceFiles()
+        .filter((sourceFile) => {
+        const rel = relByAbsolute.get(sourceFile.fileName);
+        return rel !== undefined && reportOnly.has(rel);
+    })
+        .flatMap((sourceFile) => [
+        ...program.getSemanticDiagnostics(sourceFile),
+        ...program.getSyntacticDiagnostics(sourceFile),
+    ]);
+}

package/dist/src/core/patch-lint-checkjs.d.ts

@@ -82,6 +82,8 @@ export interface RunCheckJsGroupedInput {
      * compiler options and shim in one run. See {@link runCheckJsTestFilesGrouped}.
      */
     sourceFileCache?: CheckJsSourceFileCache;
+    /** When set, diagnostics are collected only for these repo-relative files. */
+    reportOnly?: ReadonlySet<string>;
 }
 /**
  * Builds the checkJs program once over `resolutionOwned` and returns its
@@ -136,12 +138,19 @@ export declare function invokePatchLintCheckJs(repoDir: string, patchOwnedFiles:
  * reported per program (head helpers report from their own program), and
  * run-level errors are de-duplicated across programs.
  *
+ * With `resolvableModules`, a test's `resource:///` and `chrome://`
+ * imports also resolve to the modules it returns for that test (the
+ * modules the queue creates up to the test's own patch), so a test that
+ * imports an earlier patch's module is typed against its real source
+ * instead of the shim's `any` wildcard. Those modules are resolution
+ * targets only: never roots, and never reported on.
+ *
  * @param repoDir - Absolute engine (repository) directory
  * @param testFiles - Patch-owned test-script paths (repo-relative)
  * @param patchLint - The resolved `patchLint` config block
  * @param projectRoot - FireForge project root for shim resolution
  */
-export declare function runCheckJsTestFilesGrouped(repoDir: string, testFiles: Set<string>, patchLint: PatchLintConfig, projectRoot: string, rootScope?: ReadonlySet<string>): Promise<GroupedCheckJsResult>;
+export declare function runCheckJsTestFilesGrouped(repoDir: string, testFiles: Set<string>, patchLint: PatchLintConfig, projectRoot: string, rootScope?: ReadonlySet<string>, resolvableModules?: (testFile: string) => ReadonlySet<string>): Promise<GroupedCheckJsResult>;
 /**
  * Grouped variant of {@link invokePatchLintCheckJs}: builds one queue-wide
  * checkJs program over `patchOwnedFiles` and returns its findings grouped by

package/dist/src/core/patch-lint-checkjs.js

@@ -33,6 +33,7 @@ import { normalizePathSlashes } from '../utils/paths.js';
 import { withGeckoDomTypes } from './gecko-dom-types.js';
 import { anyTypedImportHint, createModuleLiteralResolver, } from './patch-lint-checkjs-any-import.js';
 import { withSharedSourceFiles } from './patch-lint-checkjs-cache.js';
+import { collectCheckJsDiagnostics } from './patch-lint-checkjs-diagnostics.js';
 import { collectUnmanagedCompanions, retargetUnmanagedCompanionHints, } from './patch-lint-unmanaged-companion.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, TEST_HARNESS_SHIM, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 // ---------------------------------------------------------------------------
@@ -340,7 +341,7 @@ export async function runCheckJsGrouped(input) {
         resolveModuleNameLiterals: createModuleLiteralResolver(resolveOwnedSpecifier, resolveViaPaths, anyTypedImports),
     };
     const program = ts.createProgram(rootFiles, options, withSharedSourceFiles(host, input.sourceFileCache, shimPath, shimSource));
-    const byFile = groupOwnedDiagnostics(ts, [...program.getSemanticDiagnostics(), ...program.getSyntacticDiagnostics()], relByAbsolute, input.mode?.undefinedIdentifiers ?? 'warning', anyTypedImports);
+    const byFile = groupOwnedDiagnostics(ts, collectCheckJsDiagnostics(program, relByAbsolute, input.reportOnly), relByAbsolute, input.mode?.undefinedIdentifiers ?? 'warning', anyTypedImports);
     verbose(`checkJs: analyzed ${rootFiles.length - 1} file(s) across ${byFile.size} owning file(s)`);
     return { byFile, global: [] };
 }
@@ -448,12 +449,19 @@ export async function invokePatchLintCheckJs(repoDir, patchOwnedFiles, patchLint
  * reported per program (head helpers report from their own program), and
  * run-level errors are de-duplicated across programs.
  *
+ * With `resolvableModules`, a test's `resource:///` and `chrome://`
+ * imports also resolve to the modules it returns for that test (the
+ * modules the queue creates up to the test's own patch), so a test that
+ * imports an earlier patch's module is typed against its real source
+ * instead of the shim's `any` wildcard. Those modules are resolution
+ * targets only: never roots, and never reported on.
+ *
  * @param repoDir - Absolute engine (repository) directory
  * @param testFiles - Patch-owned test-script paths (repo-relative)
  * @param patchLint - The resolved `patchLint` config block
  * @param projectRoot - FireForge project root for shim resolution
  */
-export async function runCheckJsTestFilesGrouped(repoDir, testFiles, patchLint, projectRoot, rootScope) {
+export async function runCheckJsTestFilesGrouped(repoDir, testFiles, patchLint, projectRoot, rootScope, resolvableModules) {
     const merged = { byFile: new Map(), global: [] };
     if (testFiles.size === 0)
         return merged;
@@ -484,7 +492,9 @@ export async function runCheckJsTestFilesGrouped(repoDir, testFiles, patchLint,
         }
         const result = await runCheckJsGrouped({
             repoDir,
-            resolutionOwned: roots,
+            resolutionOwned: new Set([...roots, ...(resolvableModules?.(file) ?? [])]),
+            rootScope: roots,
+            reportOnly: new Set([file]),
             ...(patchLint.checkJsTestShim !== undefined
                 ? { extraShimPath: patchLint.checkJsTestShim }
                 : {}),

package/dist/src/core/patch-lint-cross.d.ts

@@ -10,7 +10,7 @@
  * module.
  */
 import type { PatchLintIssue, PatchMetadata } from '../types/commands/index.js';
-import type { FireForgeConfig, PatchPolicyConfig } from '../types/config.js';
+import type { FireForgeConfig, PatchLintTokenScale, PatchPolicyConfig } from '../types/config.js';
 import type { ForwardRegistrationScope } from './patch-lint-forward-registration-extended.js';
 /**
  * One patch's contribution to {@link PatchQueueContext}.
@@ -82,6 +82,8 @@ export interface PatchQueueContext {
      * `patchLint.forwardRegistration`. Absent = `support-files` only.
      */
     forwardRegistration?: ForwardRegistrationScope;
+    /** `patchLint.tokenScales`, for the scales' `minFiles` floors. */
+    tokenScales?: PatchLintTokenScale[];
 }
 /**
  * Builds a {@link PatchQueueContext} by reading every .patch file in the

package/dist/src/core/patch-lint-cross.js

@@ -21,6 +21,7 @@ import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-dif
 import { lintPatchQueueForwardRegistrations } from './patch-lint-forward-registration.js';
 import { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';
 import { describeRegistrationFailure, findStagedRegistrationFailure, isLaterOwner, quoteRegistrationLine, STAGED_DEPENDENCY_REASON_PLACEHOLDER, stagedDependencyUnusedFingerprint, } from './patch-lint-staged-registration.js';
+import { lintTokenScaleFloors } from './patch-lint-token-scale.js';
 import { loadPatchesManifest } from './patch-manifest-io.js';
 import { categoryRangeForOrder, categoryRangeLabel } from './patch-policy.js';
 import { extractNewFileContentsFromDiff } from './patch-transform.js';
@@ -88,6 +89,9 @@ export async function buildPatchQueueContext(patchesDir, config) {
         ...(config?.patchLint?.forwardRegistration !== undefined
             ? { forwardRegistration: config.patchLint.forwardRegistration }
             : {}),
+        ...(config?.patchLint?.tokenScales !== undefined
+            ? { tokenScales: config.patchLint.tokenScales }
+            : {}),
     };
 }
 // The creators map (split out of `lintPatchQueueDuplicateCreations` so
@@ -581,5 +585,6 @@ export function lintPatchQueue(ctx) {
         ...lintPatchQueueModuleRegistrations(ctx),
         ...lintPatchQueueForwardRegistrations(ctx),
         ...lintPatchQueueBinaryBodies(ctx),
+        ...lintTokenScaleFloors(ctx.entries.flatMap((entry) => [...entry.newFiles]), ctx.tokenScales ?? []),
     ];
 }

package/dist/src/core/patch-lint-css.js

@@ -43,16 +43,20 @@ async function loadCssTokenContext(repoDir) {
  * matching how a CSS parser treats it.
  */
 export function maskCssComments(source) {
-    const masked = source.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '));
-    const openerIndex = masked.indexOf('/*');
-    if (openerIndex === -1)
-        return masked;
-    return (masked.slice(0, openerIndex) +
-        masked
-            .slice(openerIndex)
-            .split('\n')
-            .map((line) => ' '.repeat(line.length))
-            .join('\n'));
+    // Linear indexOf scan rather than a lazy `/\*[\s\S]*?\*\/` regex: with
+    // many openers and no closer, the regex retries from every `/*` to EOF
+    // (quadratic in file size).
+    let masked = '';
+    let cursor = 0;
+    for (;;) {
+        const open = source.indexOf('/*', cursor);
+        if (open === -1)
+            return masked + source.slice(cursor);
+        const close = source.indexOf('*/', open + 2);
+        const end = close === -1 ? source.length : close + 2;
+        masked += source.slice(cursor, open) + source.slice(open, end).replace(/[^\n]/g, ' ');
+        cursor = end;
+    }
 }
 const RAW_COLOR_IGNORE_MARKER = 'fireforge-ignore: raw-color-value';
 /**

package/dist/src/core/patch-lint-forward-registration-extended.d.ts

@@ -24,6 +24,11 @@ export interface ForwardRegistration {
     /** Paste-and-run declaration that records the stage as intentional. */
     command: string;
 }
+/**
+ * jar target → packaged source, over every jar.mn line the queue adds. Only
+ * exact (wildcard-free) sources can back a chrome URL lookup.
+ */
+export declare function buildJarTargetIndex(entries: readonly PatchQueueForwardRegistrationEntry[]): Map<string, string>;
 /** True for a jar.mn, moz.build or test manifest, the carriers {@link resolveCarrierReferences} reads. */
 export declare function isRegistrationCarrier(file: string): boolean;
 /**

package/dist/src/core/patch-lint-forward-registration-extended.js

@@ -116,7 +116,7 @@ function testManifestReferences(file, content) {
  * jar target → packaged source, over every jar.mn line the queue adds. Only
  * exact (wildcard-free) sources can back a chrome URL lookup.
  */
-function buildJarTargetIndex(entries) {
+export function buildJarTargetIndex(entries) {
     const index = new Map();
     for (const entry of entries) {
         for (const [file, content] of [...entry.newFiles, ...entry.modifiedFileAdditions]) {

package/dist/src/core/patch-lint-ignore.d.ts

@@ -13,7 +13,7 @@
  * (export, re-export, per-patch and aggregate lint, split, move-files)
  * shares one reading of an entry, and so `patch-lint.ts` only calls into it.
  */
-import type { LintIgnoreCeiling, LintIgnoreEntry, PatchLintIssue } from '../types/commands/index.js';
+import type { LintIgnoreCeiling, LintIgnoreEntry, PatchLintIssue, PatchSizeShare } from '../types/commands/index.js';
 /**
  * The size rules whose findings carry a `measurement`, and therefore the
  * only rules a ceiling can bound. A ceiling on any other rule could never
@@ -22,7 +22,7 @@ import type { LintIgnoreCeiling, LintIgnoreEntry, PatchLintIssue } from '../type
 export declare const LINT_IGNORE_CEILING_RULES: readonly string[];
 /**
  * A waiver filter: the bare check IDs as a set (so a plain `Set<string>`
- * still satisfies the type), plus the ceilings keyed by rule.
+ * still satisfies the type), plus the ceilings keyed by {@link ceilingKey}.
  *
  * Bare IDs and ceilings are kept apart on purpose. A caller that only knows
  * `has()` treats a ceiling-waived rule as not waived, which fails closed.
@@ -34,7 +34,10 @@ export type LintIgnoreChecks = ReadonlySet<string> & {
 export declare function isLintIgnoreCeiling(entry: LintIgnoreEntry): entry is LintIgnoreCeiling;
 /** The check ID an entry names, whatever its form. */
 export declare function lintIgnoreRule(entry: LintIgnoreEntry): string;
-/** One-word rendering for summaries and dry runs: `file-too-large<=1200`. */
+/**
+ * One-word rendering for summaries and dry runs: `file-too-large<=1200`,
+ * `large-patch-lines[test]<=900`.
+ */
 export declare function formatLintIgnoreEntry(entry: LintIgnoreEntry): string;
 /** Renders a list for messages, `(empty)` when there is nothing to show. */
 export declare function formatLintIgnoreList(entries: readonly LintIgnoreEntry[]): string;
@@ -46,6 +49,9 @@ export declare function formatLintIgnoreList(entries: readonly LintIgnoreEntry[]
  * integer `max` and a non-empty `reason`, and must be the only entry for
  * its rule: a bare ID beside a ceiling for the same rule would make the
  * ceiling dead, and two ceilings would leave the effective one ambiguous.
+ * The one exception is `large-patch-lines`, which may carry one ceiling
+ * per `share` instead of a single share-less one. `meta` must be a JSON
+ * object and is kept verbatim.
  *
  * @param raw - The value under `lintIgnore`
  * @param label - Field label for error messages, e.g. `patches[3].lintIgnore`
@@ -70,15 +76,18 @@ export declare function lintIgnoreCacheTokens(checks: LintIgnoreChecks | undefin
  * semantics `export` / `re-export --lint-ignore` have always had. A bare ID
  * whose rule already has an entry (bare or ceiling) is a no-op: widening a
  * reviewed ceiling to an unbounded waiver is `patch lint-ignore`'s job, where
- * it is confirmed explicitly.
+ * it is confirmed explicitly. Ceilings deduplicate by rule and share, so a
+ * rule's per-share ceilings all survive.
  *
  * @returns The merged list, or undefined when it is empty
  */
 export declare function mergeLintIgnoreIds(existing: readonly LintIgnoreEntry[] | undefined, ids: readonly string[] | undefined): LintIgnoreEntry[] | undefined;
 /**
- * Adds or replaces entries by rule, the `patch lint-ignore --add` semantics:
- * an explicit `--add <rule>` turns a ceiling into a bare waiver, and
- * `--add <rule> --max <n>` sets or moves the ceiling.
+ * Adds or replaces entries, the `patch lint-ignore --add` semantics: an
+ * explicit `--add <rule>` turns a rule's ceilings into a bare waiver,
+ * `--add <rule> --max <n>` sets or moves the rule's ceiling, and a
+ * share-scoped ceiling replaces only its own share (plus any bare or
+ * share-less entry for the rule, which it would contradict).
  *
  * @returns The new list, or undefined when it is empty
  */
@@ -120,16 +129,43 @@ export interface LintIgnoreCeilingStatus {
     rule: string;
     max: number;
     reason: string;
+    /** The share the ceiling bounds, when it is share-scoped. */
+    share?: PatchSizeShare;
+    /** The ceiling's `meta`, verbatim, when it has one. */
+    meta?: Record<string, unknown>;
     /** Largest current measurement for the rule, null when none was taken. */
     measurement: number | null;
     /**
-     * `exceeded`: a finding measured past `max` and surfaced.
+     * `exceeded`: a warning- or error-band finding measured past `max` and
+     * surfaced. A notice never exceeds a ceiling: it gates nothing.
      * `removable`: the rule no longer reaches its own warning band, so the
      * waiver changes no gate and can be dropped.
      * `within`: the waiver is doing its job.
      */
     state: LintIgnoreCeilingState;
 }
+/**
+ * One waiver's standing, bare or ceiling, as the report's
+ * `lintIgnoreWaivers` records it. A bare waiver has `max: null`; its
+ * `state` is `within` while the rule still finds something to suppress at
+ * warning band or above, and `removable` otherwise (informational: a bare
+ * waiver of a rule this lint does not run reads as removable too).
+ */
+export interface LintIgnoreWaiverStatus {
+    kind: 'bare' | 'ceiling';
+    rule: string;
+    max: number | null;
+    reason: string | null;
+    share?: PatchSizeShare;
+    meta?: Record<string, unknown>;
+    measurement: number | null;
+    state: LintIgnoreCeilingState;
+}
+/** Patch-level measurements a size rule falls back to when it did not fire. */
+interface PatchMeasurements {
+    lines: number;
+    files: number;
+}
 /**
  * Evaluates each ceiling on a patch against the findings its lint produced
  * (both surfaced and suppressed).
@@ -140,13 +176,21 @@ export interface LintIgnoreCeilingStatus {
  *   patch-size rule did not fire at all, so the report still shows the
  *   current number
  */
-export declare function evaluateLintIgnoreCeilings(entries: readonly LintIgnoreEntry[] | undefined, issues: readonly PatchLintIssue[], patchMeasurements: {
-    lines: number;
-    files: number;
-}): LintIgnoreCeilingStatus[];
+export declare function evaluateLintIgnoreCeilings(entries: readonly LintIgnoreEntry[] | undefined, issues: readonly PatchLintIssue[], patchMeasurements: PatchMeasurements): LintIgnoreCeilingStatus[];
+/**
+ * Evaluates every waiver on a patch, bare IDs included, so a waiver audit
+ * reads each one's current measurement from the report instead of
+ * re-measuring bare waivers from `suppressedIssues`.
+ *
+ * @param entries - The patch's `lintIgnore`
+ * @param issues - Every finding of the patch's lint, surfaced and suppressed
+ * @param patchMeasurements - See {@link evaluateLintIgnoreCeilings}
+ */
+export declare function evaluateLintIgnoreWaivers(entries: readonly LintIgnoreEntry[] | undefined, issues: readonly PatchLintIssue[], patchMeasurements: PatchMeasurements): LintIgnoreWaiverStatus[];
 /**
  * Notice-severity findings for ceilings that are no longer needed, so the
  * waiver's removal is prompted by the tool that enforces it rather than
  * discovered by hand.
  */
 export declare function removableCeilingIssues(patchFilename: string, statuses: readonly LintIgnoreCeilingStatus[]): PatchLintIssue[];
+export {};